Lucene search

K
centosCentOS ProjectCESA-2005:416-01
HistoryJun 05, 2005 - 10:52 p.m.

kdbg security update

2005-06-0522:52:58
CentOS Project
lists.centos.org
51

4.6 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

0.0004 Low

EPSS

Percentile

5.1%

CentOS Errata and Security Advisory CESA-2005:416-01

Kdbg is a K Desktop Environment (KDE) GUI for gdb, the GNU debugger.

Kdbg 1.1.0 through 1.2.8 does not check permissions of the .kdbgrc file.
If a program is located in a world-writable location, it is possible for a
local user to inject malicious commands. These commands are then executed
with the permission of any user that runs Kdbg. The Common Vulnerabilities
and Exposures project assigned the name CAN-2003-0644 to this issue.

Users of Kdbg should upgrade to this updated package, which contains a
backported patch to correct this issue.

Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-announce/2005-June/073956.html

Affected packages:
kdbg

OSVersionArchitecturePackageVersionFilename
CentOS2i386kdbg< 1.2.1-7kdbg-1.2.1-7.i386.rpm

4.6 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

0.0004 Low

EPSS

Percentile

5.1%